The Kabul Tribune (KT) — The Financial Times reported that a major UK government data breach that exposed tens of thousands of Afghans to potential reprisals by the Taliban was a "foreseeable systemic failure," according to a British parliamentary committee.
The breach occurred in February 2022, when a British soldier
accidentally sent an Excel file containing the personal information of about 25,000
Afghans who had applied for relocation to the United Kingdom. Many of the
applicants had previously worked with or supported the British government
before the Taliban returned to power.
The House of Commons Defence Committee described the
incident and its aftermath as a broader failure of governance, accountability
and public trust. The committee criticized the Ministry of Defence (MoD) for
inadequate data protection practices and the secrecy surrounding the breach,
the Financial Times reported.
The leaked file initially appeared to contain information on
about 150 relocation applicants. However, the spreadsheet also contained hidden
personal details of more than 18,500 additional applicants, according to the
committee.
The committee said the MoD had used Excel spreadsheets to
manage large amounts of sensitive personal information without adequately
addressing the known risk that such files could contain hidden data.
The report described the breach as the result of a system
that lacked appropriate tools, controls, training and oversight for handling
sensitive information.
The committee also found that the unit responsible for
Afghan relocation reported 18 additional personal data security incidents
during the 21 months following the major breach. The unit had also faced
parliamentary scrutiny over a separate data breach in 2021.
The breach was discovered 18 months later, in August 2023,
after which a super-injunction was issued preventing media organizations from
reporting on the incident. The restriction was lifted in July 2025.
British lawmakers criticized the use of the
super-injunction, saying it obstructed parliamentary and media scrutiny of the
breach and efforts to relocate affected Afghans.
The committee warned future governments against using
super-injunctions to suppress issues of significant public interest, saying
secrecy surrounding the incident lasted too long while accountability and
assistance for affected Afghans were inadequate.
In December 2025, about 1,000 people affected by the breach
took the initial steps toward legal action against the Ministry of Defence,
according to the Financial Times.
The relocation of Afghans affected by the breach is still
ongoing.
Labour MP Tan Dhesi, chair of the Defence Committee, also
criticized a government policy announced in April 2026 requiring applicants to
travel to a visa center in a third country for security checks. He warned that
the policy could exclude eligible Afghans who cannot safely, legally or
affordably travel to another country.
The Ministry of Defence said it had introduced reforms,
including improvements to its data protection standards.
"Thousands of eligible Afghans have already been safely
relocated to the UK," the ministry said, adding that it remained committed
to completing the Afghan Resettlement Programme by the end of the current
parliamentary term.
